Amus was found on 5th of August 2004. It's a simple massmailer written in Visual Basic.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Amus is packed with Yoda. It's packed size is 51782.
Once executed it creates a a mutex named "Masum". In order to avoid being run more than once. And copies itself to
C:\masum.exe
It drops copies of itself in the Windows folder with names from:
Messenger.exe My_Pictures.exe Meydanbasi.exe Pide.exe Pire.exe Cekirge.exe Ankara.exe Adapazari.exe Anti_Virus.exe KdzEregli.exe
A registry key will be set to point to one of the dropped files:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] "Microzoft_Ofiz" = "C:\%WinDir%\KdzEregli.exe"
Where %WinDir% is the main Windows folder.
It send emails with subject:
Listen and Smile
And body:
Hey. I beg your pardon. You must listen.
The attached file will be named:
masum.exe
When the virus is run, it uses the Windows Speech Engine to speak the following message:
How are you. I am back. My name is mister hamsi. I am seeing you. Haaaaaaaa. You must come to turkiye. I am cleaning your computer. 5. 4. 3. 2. 1. 0. Gule. Gule.
To listen to what the message sounds like, listen to this audio file:
https://www.f-secure.com/weblog/archives/amus.wav
If the day of the month is 10th or 23rd, the worm will attempt to delete all INI files from the Windows folder.
If the day of the month is 2nd, 15th or 17th, the worm will attempt to delete all DLL files from the Windows folder.